CVE-2021-31166

CVE-2021-31166 Detection of attempts to exploit CVE-2021-31166 HTTP Protocol Stack vulnerability Suricata rule Zeek Package References https://corelight.blog/2021/05/27/detecting-cve-2021-31166-http-vulnerability/ https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166...

cve-2017-7269

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services IIS 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: http://" in a PROPFIND request, as exploited in the wild ...

shepard

SHEPARD BITS This is a persistance tool using Windows Background Intelligent Transfer Service BITS. Functionality File Download, File Exfiltration, File Download + Persistent Execution Usage Run shepard.exe as Administrator with the following command line arguments: -d : regular file download to ...

webdav_exploit

webdavexploit An exploit for Microsoft IIS 6.0 CVE-2017-7269 based on https://github.com/edwardz246003/IISexploit but works remotely usage root@kitploit: python exploit.py -d http://www.eliuha.com/eliuha...

pwnspoof

pwnSpoof from Punk Security generates realistic spoofed log files for common web servers with customisable attack scenarios. Every log bundle is unique and completely customisable, making it perfect for generating CTF scenarios and for training serials. Can you find the attacker session and build...

CVE-2017-7269

CVE-2017-7269 - IIS 6.0 WebDAV Buffer Overflow A Rust implementation of the POC for CVE-2017-7269, targeting the WebDAV service in Microsoft Internet Information Services IIS 6.0. Vulnerability Overview CVE-2017-7269 is a critical stack-based buffer overflow vulnerability found in the WebDAV...

CVE-2026-49975-HTTP-2-Bomb

A triage not exploitation tool to identify attack surfaces exposed to CVE-2026-49975 — "HTTP/2 Bomb". ⚠️ This script does not send attack payloads. It only makes normal HTTP requests and analyzes response headers to flag hosts that warrant manual version/patch verification. About CVE-2026-49975...

CVE-2022-21907

CVE-2022-21907 - HTTP Protocol Stack Remote Code Execution Vulnerability ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author NU11SECURITY and michelep Description: HTTP Protocol Stack Remote Code Execution...

CVE-2021-31166-detection-rules

CVE-2021-31166 Detection Rules Different rules to detect if CVE-2021-31166 is being exploited Rules available: Suricata Snort The snort rules also work on suricata. Zeek To Do: Make PCAPs available which where used during the development of the signatures Zeek script Detection when the...

CVE-2017-7269

CVE 2017.7269 PoC Index CVE 2017.7269 PoC Index Authors Abstract What is Microsoft IIS? What is Microsft Windows server? What is WebDAV? Description Usage: References & Discoverers Authors NoexDevPen - Beacons Profile mag4no10 - Beacons Profile Abstract What is Microsoft IIS? Internet Information...

CVE-2021-31166

CVE-2021-31166 Why I recently wrote an exploit for CVE-2021-31166, it exploit CVE-2021-31166 and CVE-2021-31166. A pentester should use https://github.com/mauricelambert/CVE-2021-31166, but in SOC teams we need to know the specific vulneraility to fix it properly, which is why i wrote this exploi...

shortscan

🌀 Shortscan Una herramienta de enumeración de nombres cortos de archivos en IIS. Funcionalidad Shortscan está diseñado para determinar rápidamente qué archivos con nombres cortos existen en un servidor web IIS. Una vez identificado un nombre corto, la herramienta intentará identificar...

MS15-034

MS15-034 MS15-034 POC La versión actual del servidor IIS es una versión vulnerable que contiene la vulnerabilidad conocida CVE-2015-1635, MS15-034. Al explotar esta vulnerabilidad, existe el riesgo de sufrir ataques como ejecución remota de código o provocar una pantalla azul. Sintaxis de prueba:...

CVE-2023-36899

CVE-2023-36899 Reproduction environment and tooling for CVE-2023-36899, a cookieless session authentication bypass in the ASP.NET framework. Cookieless DuoDrop: IIS Auth Bypass & App Pool Privesc in ASP.NET Framework CVE-2023-36899 In modern web development, despite cookies being the preferred...

CVE-2017-7269

CVE-2017-7269 Número de vulnerabilidad: CVE-2017-7269 Descubierto por: Zhiniang Peng y Chen Wu Laboratorio de Seguridad Informática de la Universidad Tecnológica del Sur de China, Escuela de Ciencias de la Computación e Ingeniería Descripción de la vulnerabilidad: IIS 6.0 no habilita WebDAV de...

CVE-2025-53772-IIS-WebDeploy-RCE

CVE-2025-53772 - IIS WebDeploy RCE Exploit This repository contains a Proof-of-Concept PoC exploit for CVE-2025-53772, a Remote Code Execution vulnerability in IIS WebDeploy through unsafe deserialization. ⚠️ Disclaimer This tool is for educational and authorized security testing purposes only. Th...

IIS_6.0_WebDAV_Ruby

IIS6.0WebDAVRuby Ruby Exploit for IIS 6.0 Buffer Overflow CVE-2017-7269 This exploit takes advantage of the ScStoragePathFromUrl buffer overflow found by Zhiniang Peng and Chen Wu. Usage: ruby exploit.rb Encoding option denotes mandatory options...

Kentico CMS Insecure Deserialization Remote Code Execution

Kentico CMS is susceptible to remote code execution via a .NET deserialization vulnerability. id: CVE-2019-10068 info: name: Kentico CMS Insecure Deserialization Remote Code Execution author: davidmckennirey severity: critical description: Kentico CMS is susceptible to remote code execution via a...

Microsoft SharePoint - Remote Code Execution

Microsoft SharePoint is vulnerable to a remote code execution when the software fails to check the source markup of an application package. id: CVE-2020-16952 info: name: Microsoft SharePoint - Remote Code Execution author: dwisiswant0 severity: high description: Microsoft SharePoint is vulnerabl...

Penetration-Testing-Assessment-23-04-2026

Informe de Pruebas de Penetración – Explotación de IIS WebDAV Resumen Este proyecto demuestra un ciclo de vida completo de pruebas de penetración realizado en un sistema objetivo vulnerable. La evaluación sigue un enfoque estructurado que incluye reconocimiento, escaneo, enumeración, explotación ...